# GHSA-8r99-h8j2-rw64: Twisted vulnerable to HTTP Request Smuggling Attacks

> Twisted Web is vulnerable to HTTP request smuggling, allowing attackers to desynchronize request handling and potentially access or modify data.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 7 Oct 2022

## What is GHSA-8r99-h8j2-rw64?

GHSA-8r99-h8j2-rw64 is a vulnerability in twisted, published on 7 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Impact
Twisted Web is vulnerable to request smuggling attacks:

1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response." (Jake Miller of Bishop Fox Security)
2. " When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length." (Jake Miller of Bishop Fox Security)
3. ~"Twisted should not allow BWS between the filed-name and colon." (ZeddYu Lu)~ _closed in 9646_
4. "Two CL header with different values is also not allowed." (ZeddYu Lu)
5. "Only accept identity and chunked Transport-Encoding." (ZeddYu Lu)

### Patches
https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081
https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281

### Workarounds
N/A

### References
https://portswigger.net/web-security/request-smuggling

## Which versions are affected by GHSA-8r99-h8j2-rw64?

2 open source packages ship an affected version, including twisted.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `twisted` | PyPI | All versions | 20.3.0 |
| `twisted` | PyPI | All versions | 20.3.0 |

## How do I fix GHSA-8r99-h8j2-rw64?

Upgrade twisted to 20.3.0 or later.

## Is GHSA-8r99-h8j2-rw64 being exploited?

There is no known exploitation of GHSA-8r99-h8j2-rw64 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-8r99-h8j2-rw64 and fix it if it is affected.

What it is: GHSA-8r99-h8j2-rw64 is a vulnerability in twisted, published on 7 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-8r99-h8j2-rw64 in the wild and no public exploit code.

Affected packages and fixed versions:
- twisted (PyPI): affected all versions; fixed in 20.3.0
- twisted (PyPI): affected all versions; fixed in 20.3.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/ (Markdown: https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-8r99-h8j2-rw64

---
From sbomify Insights: https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/
Summaries are generated and may contain mistakes; the official description above is the record.